Coverity user model#3815
Merged
Merged
Conversation
The static analysis engine coverity allows for user models overriding how it treats functions when analyzing code. Like this, one can greatly reduce the rate of false positives and thus make it easier to spot actual errors. Add a user model that overrides function models for `git_buf_len` and `git_vector_insert`, which together amount for a majority of false positives.
The `git_buf` structure seems to be too complicated to correctly grasp for Coverity. As such, add simpler models trying to guide Coverity and remove false positives related to these functions.
Member
|
Merging this I did upload the modeling file, we can iterate if it's not successful. |
Member
Author
|
While not fixing as much as I'd hoped, at least some bugs went away. Thanks for merging this. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
So by now more than half of the issues reported by Coverity can be labeled as false positives as the number of issues went down. I've written a user model that I am using to fix most of these false positives in my own fork, which brings down the number of issues from 37 to 14. Most of these issues are related to either git_vector or git_buf, which seem to be too complex to handle for Coverity.
I've split up this PR into two commits. The first commit includes the user model I am actually using right now. Due to an expired license (dunno why, I've contacted Coverity support but got no feedback until now) I am not able to update the user model, though, so I cannot test changes made in the second commit.
I'd be glad if this got accepted. Accepting alone won't help, though, as there seems to be no simple way of using the model when executing Coverity's tooling. Instead, someone needs to update the user model online. To do so, you'll have to go to scan.coverity.com, select the libgit2 project and then select the tab "Analysis Settings". There is a section "Modeling File" at the bottom where the file can be uploaded.